Duo Security SAML configuration

Set up Single Sign-On (SSO) for your organization using Duo.

1. Log in to duo.com.
2. On the side menu, select Applications > Protect an Application.
3. Search for “SAML service provider” and select Protect this Application.

4. On the next screen, enter the following details.
   1. Service Provider Name: Canva
   2. Entity ID: https://www.canva.com
   3. Assertion Consumer Service: https://www.canva.com/login/saml

5. Click Save.
6. Click Download your configuration file. You’ll upload this into your Duo Access Gateway in the next steps.

1. Log in to your Duo Access Gateway and go to Applications.
2. On the Add Application section, upload the configuration file you downloaded.
3. On the Metadata section, copy the following details. You’ll need them to complete the setup in Canva.
   • SSO URL
   • Entity ID
   • Certificate (Click Download certificate and copy the file contents)

1. Log in to your Canva account.
2. On the upper corner of the homepage, click the
   gear icon to go to Settings.
3. From the side menu, click the
   SSO and provisioning tab.
4. Under Domain verification, enter your team’s domain.
5. Click Submit domain. You will then be provided with a DNS token.
6. Create a TXT record of the DNS token using your domain host. Help from your IT team might be needed for this step.

Learn more about adding a TXT record in our Setting up Single Sign-on (SSO) article.

1. Log in to your Canva account.
2. In the bottom-left corner, click your profile avatar, then select Settings.
3. From the side menu, click the SSO and provisioning tab.
4. Click Single sign-on (SSO) > Manage > Edit IdP metadata.
5. Enter your identity provider’s details in the three fields:

• SSO or login URL: Paste your SSO URL.
• Entity ID or Issuer URL: Paste your Entity ID.
• X.509 Public Certificate: Paste all of the contents from your Certificate.

6. Click Save and next.

There are two easy ways to test your SSO setup:

If you're still on the Set up SSO page, scroll to the Test your SSO connection section and click Test SSO. If you're starting from the Canva homepage instead:

1. In the bottom-left corner, click your profile avatar, then select Settings.
2. From the side menu, click the SSO and provisioning tab.
3. Under Single sign-on (SSO) > Manage > Test SSO.

This lets you quickly check if everything's working without logging out.

1. Before logging out, go to the SSO and provisioning tab.
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Set the login option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, click Continue with email, then select Log in with SSO.

Quick tip: Using both methods can give you extra peace of mind that everything’s set up right.

Choose how you want people to log in to your SSO-managed team(s).

1. From the homepage, go to Settings > SSO and provisioning.
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Select one of the login options. Learn more about each option in Setting up login and signup controls.
4. Click Save changes.